feat(node): metrics for attestation freshness #14941
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| merge_group: | |
| push: | |
| branches: | |
| - main | |
| # Primes the new week's Rust cache on main right after the weekly `prefix-key` rolls | |
| # over at UTC Sun 00:00. Without this, the first PR on Sunday pays a full cold-build | |
| # cost and (since `save-if` requires main) doesn't save, so every subsequent Sunday | |
| # PR keeps cold-building until something merges to main. See near/mpc#2828. | |
| schedule: | |
| - cron: "5 0 * * 0" | |
| jobs: | |
| # Downstream gates use `if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}`. | |
| # `!cancelled()` overrides GitHub's implicit `success()` on `needs`, so a | |
| # failed detector doesn't silently skip dependents (skipped checks satisfy | |
| # required-check rules and could let a PR merge with zero CI signal). Only | |
| # an explicit `'false'` (docs-only PR) skips the job. Unlike `always()`, it | |
| # stops evaluating to true once the run is cancelled, so a new push cancels | |
| # the in-progress run instead of queueing behind it. | |
| changes: | |
| name: "Detect non-docs changes" | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| uses: ./.github/workflows/changes.yml | |
| docker-tee-build: | |
| name: "Build MPC Node TEE Docker image" | |
| needs: changes | |
| if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }} | |
| runs-on: warp-ubuntu-2604-x64-16x | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Allow unprivileged user namespaces (needed by repro-env) | |
| run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 | |
| - name: Install repro-env | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y repro-env | |
| - name: Build MPC Node binary and image | |
| run: | | |
| export NODE_IMAGE_NAME=test_image_tag_ci | |
| ./deployment/build-images.sh --node | |
| - name: Check mpc-node docker image can initialize and start | |
| run: | | |
| export NODE_IMAGE_NAME=test_image_tag_ci | |
| ./scripts/check-mpc-node-docker-starts.sh | |
| docker-rust-launcher-build-and-verify: | |
| name: "Build Rust Launcher Docker image and verify" | |
| needs: changes | |
| if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }} | |
| runs-on: warp-ubuntu-2604-x64-8x | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Allow unprivileged user namespaces (needed by repro-env) | |
| run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 | |
| - name: Install build dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y liblzma-dev repro-env | |
| - name: Build Rust launcher docker image | |
| shell: bash | |
| run: | | |
| ./deployment/build-images.sh --rust-launcher | |
| - name: Run Rust launcher non-TEE runtime check | |
| shell: bash | |
| run: | | |
| ./scripts/check-mpc-node-docker-starts.sh --rust-launcher | |
| mpc-unittests: | |
| name: "Cargo test: ${{ matrix.group }}" | |
| needs: changes | |
| # Start (unless the run is cancelled) so GitHub expands the matrix and | |
| # registers each check name ("Cargo test: node", etc.). | |
| # Skipping at the job level only registers unexpanded template name and | |
| # required checks will be stuck. | |
| if: ${{ !cancelled() }} | |
| runs-on: ${{ matrix.runner || 'warp-ubuntu-2604-x64-16x' }} | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - group: "node" | |
| nextest-args: "-p mpc-node" | |
| - group: "contract" | |
| nextest-args: "--profile=ci-contract -p mpc-contract" | |
| extra-tools: true | |
| runner: warp-ubuntu-2604-x64-32x | |
| - group: "other" | |
| nextest-args: "--profile=ci-other" | |
| extra-tools: true | |
| steps: | |
| - name: Checkout repository | |
| if: needs.changes.outputs.code_changed != 'false' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| if: needs.changes.outputs.code_changed != 'false' | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - name: Restore /nix from cache | |
| id: nix-cache | |
| if: needs.changes.outputs.code_changed != 'false' | |
| uses: ./.github/actions/restore-nix-cache | |
| - run: echo "WEEK=$(date -u +%Y-%U)" >> "$GITHUB_ENV" | |
| if: needs.changes.outputs.code_changed != 'false' | |
| - name: Cache Rust dependencies | |
| if: needs.changes.outputs.code_changed != 'false' | |
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| cache-provider: "warpbuild" | |
| prefix-key: v1-rust-tests-${{ matrix.group }}-week-${{ env.WEEK }}-nix-${{ steps.nix-cache.outputs.cache-key-hash }} | |
| - name: Run cargo-nextest | |
| if: needs.changes.outputs.code_changed != 'false' | |
| run: nix develop --command cargo nextest run --cargo-profile=test-release --all-features --locked ${{ matrix.nextest-args }} | |
| mpc-contract-reproducible-build: | |
| name: "MPC contract reproducible build" | |
| needs: changes | |
| if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }} | |
| runs-on: warp-ubuntu-2604-x64-16x | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| # only save nix cache in this single job to avoid duplicate cache saves from other jobs | |
| - name: Restore /nix from cache | |
| uses: ./.github/actions/restore-nix-cache | |
| with: | |
| save: ${{ github.ref == 'refs/heads/main' }} | |
| # Reproducible build that carries NEP-330 metadata; this is what the | |
| # release artifact uses and what sourcescan.io / nearblocks replay. | |
| - name: Build mpc-contract (reproducible, cargo-near) | |
| run: nix develop --command cargo near build reproducible-wasm --manifest-path crates/contract/Cargo.toml | |
| - name: Check contract WASM size | |
| run: nix develop --command bash scripts/check-contract-wasm-size.sh target/near/mpc_contract/mpc_contract.wasm | |
| # Independent reproducible path: the Nix derivation produces the contract WASM | |
| # without a third-party Docker image. Kept exercised alongside the cargo-near | |
| # build; see docs/reproducible-builds.md. | |
| nix-build-mpc-contract: | |
| name: "Nix build mpc-contract" | |
| needs: changes | |
| if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }} | |
| runs-on: warp-ubuntu-2604-x64-16x | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - name: Restore /nix from cache | |
| uses: ./.github/actions/restore-nix-cache | |
| - name: Build mpc-contract (Nix) | |
| run: nix build -L .#mpc-contract | |
| nix-build-mpc-node: | |
| name: "Nix build mpc-node" | |
| needs: changes | |
| if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }} | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/nix-build-mpc-node.yml | |
| fast-ci-checks: | |
| name: "Fast CI checks" | |
| runs-on: warp-ubuntu-2604-x64-8x | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - name: Restore /nix from cache | |
| id: nix-cache | |
| uses: ./.github/actions/restore-nix-cache | |
| - run: echo "WEEK=$(date -u +%Y-%U)" >> "$GITHUB_ENV" | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| cache-provider: "warpbuild" | |
| prefix-key: v1-rust-week-${{ env.WEEK }}-nix-${{ steps.nix-cache.outputs.cache-key-hash }} | |
| - name: Run cargo-make fast checks | |
| run: nix develop --command cargo make check-all-fast | |
| mpc-e2e-tests: | |
| name: "MPC E2E tests" | |
| needs: changes | |
| if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }} | |
| runs-on: warp-ubuntu-2604-x64-32x | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - name: Restore /nix from cache | |
| id: nix-cache | |
| uses: ./.github/actions/restore-nix-cache | |
| - run: echo "WEEK=$(date -u +%Y-%U)" >> "$GITHUB_ENV" | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| with: | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| cache-provider: "warpbuild" | |
| prefix-key: v1-rust-e2e-week-${{ env.WEEK }}-nix-${{ steps.nix-cache.outputs.cache-key-hash }} | |
| - name: Build mpc-node | |
| run: nix develop --command cargo make build-mpc-node-network-hardship-simulation | |
| # Both build paths emit target/near/mpc_contract/mpc_contract.wasm, which | |
| # MPC_CONTRACT_WASM points at. On main we exercise the fully reproducible | |
| # (docker) build; on PRs the faster non-reproducible cargo-near build. | |
| - name: Build mpc-contract | |
| if: github.ref != 'refs/heads/main' | |
| run: nix develop --command cargo make build-mpc-contract-optimized | |
| - name: Build mpc-contract reproducibly | |
| if: github.ref == 'refs/heads/main' | |
| run: nix develop --command cargo near build reproducible-wasm --manifest-path crates/contract/Cargo.toml | |
| - name: Build tee-verifier | |
| run: nix develop --command cargo make build-tee-verifier-optimized | |
| - name: Build test-parallel-contract | |
| run: nix develop --command cargo make build-test-parallel-contract-optimized | |
| - name: Build backup-cli | |
| run: nix develop --command cargo make build-backup-cli | |
| - name: Run E2E tests | |
| run: nix develop --command cargo make e2e-tests-skip-build | |
| env: | |
| RUST_LOG: info,e2e_tests=debug | |
| ci-extra: | |
| name: "Extra CI checks" | |
| needs: changes | |
| if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }} | |
| runs-on: warp-ubuntu-2604-x64-2x | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| - name: Restore /nix from cache | |
| uses: ./.github/actions/restore-nix-cache | |
| - name: Run cargo-make extra checks | |
| run: nix develop --command cargo make check-extra | |
| check-todo-closed-issues: | |
| name: "Check TODOs for issues closed by this PR" | |
| if: github.event_name == 'pull_request' | |
| runs-on: warp-ubuntu-2604-x64-2x | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Check TODOs for issues closed by this PR | |
| run: bash .github/scripts/check-todo-closed-issues.sh | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} |